[joshstrange]

So this was her personal account? Not a business account?

My sister's business account was hacked (phished probably) and was contacted by the scammer asking for money to get the account back. IG's support is practically non-existent and their automated tools don't help at all if the scammer changes the username/email. She got it back a few days later by going through her state's government. Apparently they have contacts at FB/IG/etc to escalate cases affecting businesses based in their state. She got put in contact with this rep through a friend of a friend so I don't know how easy it is to make use of this "resource". You'd think it would be easy for IG to notice that an account being logged in from a new location, username changed, password changed, and email changed is probably a victim but their systems did nothing.

If it's a personal account your best bet is to make noise online, have a friend that works at IG, or do what the other comment here says about contacting IG PMs on Twitter which is a sad state of affairs. Whatever you do DO NOT pay anyone online promising to get the account back. There are plenty of people with "testimonials" of people they have helped, don't fall for it.